Watch Out for These Sneaky Phishing Scams

Cybercriminals constantly find new ways to trick people into giving up their personal information. Here are a few of the scams we have seen in recent weeks.

Job-Seeker Scams

Recently, scammers have been impersonating Carilion recruiters and posting fake Carilion jobs on career websites. Here are a few key things to keep in mind if you or someone you know is contacted about a job offer you weren't expecting:

• Be skeptical. If you've had no previous communication with the company offering the position, research the company online and contact them via a reputable source (ie. LinkedIn, Indeed, Glassdoor, the company's career page).  
• Look for misspellings of the company name and job locations that are not in line with the company's website.  
• Never send personal or banking information via e-mail or text. Carilion Clinic will always direct you to a secure site with login to collect this information.  

When our Talent Acquisition team contacts job candidates, they will not ask you for personal or financial information through phone, text or email. Current employees are encouraged to apply for job transfers through our SAP employee portal.

Online Quizzes

These aren't new, but it's important to stay vigilant about sharing your information online.

• These fun little quizzes will ask you a series of questions to let you know what kind of flower you are, your spirit anima, or what food group you belong in.
• Some scammers hack social media accounts and send malware links to friends of the hacked account holder under the guise of sharing a quiz.
• The questions usually seem innocent. For example: “What was your first car” or “What’s your high school mascot?” 
• Scammers use your answers to try and crack password hints or security questions used to log in to a website, primarily your social media accounts.
• Once scammers get access to your account, they use it to spam your friends or even gain access to your other accounts.
• If you want to do online quizzes, don’t answer honestly!
• If you want to doubly protect yourself, don’t answer your password security questions honestly. For example, when asked for your mother’s maiden name, don’t use her real name, but use a word you’ll remember, like “tree.”

For more information, visit the FTC website.  

What To Do If You Receive a Suspicious Message

Text message:

• If you receive a suspicious text message on a work-issued device, report it to the TSC without replying to the message. Do not click on any links or images in the text.
• If you receive a suspicious text message on a personal device, use available features within your messaging application to report the text, or simply delete it without engaging.

Emails:

• Report any suspicious emails you receive at work using the Report Phish button in your email menu bar.
• If you receive a suspicious email in a personal inbox, use available features within your application to report the message as spam or malicious, or simply delete the email without engaging.

Questions?

If you have questions, email our Information Security team at office_of_information_security@carilionclinic.org.